The 20-Minute Compromise: CI/CD Audit Guide and Substrate Governance Analysis of the TanStack Supply Chain Attack

The Attack and Its Governance Lesson

The TanStack NPM supply chain attack compromised 84 package versions across 42 packages in approximately 20 minutes. The attack chain was: pull_request_target misconfiguration → build cache poisoning → OIDC token extraction from runner process memory → authenticated publication of malicious packages.

The attack succeeded not because authentication failed, but because the build cache was operating as an ungoverned substrate participant. OIDC authentication was working correctly throughout. The token was valid. The workload was authenticated. The authorization was granted. Everything the Workload Identity Federation model was designed to protect was functioning as intended.

OIDC authentication governs who can write to the cache. It does not govern the lineage integrity of what the cache contains. The build cache is a substrate participant—it receives artifacts from trusted processes and feeds them back into subsequent builds without re-verification. When the cache lineage is broken, every downstream build inherits the compromise invisibly.

This guide provides a three-part audit framework for detecting and hardening against this exact attack chain, followed by the substrate governance analysis that explains why OIDC alone cannot prevent it.